#!/bin/bash

#------------------------------------------------------------------------------
#Filename:	74773-hidepid.sh
#Version:	1.1
#Date:		2013/07/15
#Author:	yuanhui.shi
#Email:		yuanhui.shi@cs2c.com.cn
#Summary:	02.01系统核心功能-05内核支持-03附加挂载选项-01hidepid=1
#Notes:		keyword hidepid=1
#Copyright:	China Standard Software Co.,Ltd.
#History:
#		Version 1.0,2013/07/15
#		-The first one
#		Version 1.1,2013/09/05
#		-Modify the script to satisfy the shell standard
#------------------------------------------------------------------------------


PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
export PATH

source ../../lib/Echo.sh
source ./lib/Ssh.sh

function CleanData ()
{
  rm -rf /tmp/tmp.log1
  rm -rf /tmp/tmp.log2
  mount -o remount,hidepid=0 /proc/

  userdel -r test
  
  EchoInfo "74773-hidepid.sh执行完毕"
}

trap "CleanData" EXIT

#默认情况下hidepid=0，表示所有用户可看到/proc/PID/*文件。该脚本设置hidepid=1，普通用户可以查看到自己的进程，可以查看/proc/下其他进程ID号，无权限查看其他进程/proc/PID/*下的文件。

EchoInfo "设置挂载参数hidepid=1，并重新挂载"
mount -o remount,hidepid=1 /proc/

Adduser "test" "qwer1234"

Ssh "test" "127.0.0.1" "qwer1234" "ls /proc &> /tmp/tmp.log1"
#test -z "`grep '不允许的操作' /tmp/tmp.log1`"  
[ `wc -l /tmp/tmp.log1 | awk '{print $1}'` -gt 10 ]
EchoResult "可以查看到自己的进程" 

grep -w "1" /tmp/tmp.log1
EchoResult "可以查看/proc/下其他进程ID号" 

Ssh "test" "127.0.0.1" "qwer1234" "LANG=C ls -l /proc/1 > /tmp/tmp.log2 2>&1"
#test -n "`grep '无法' /tmp/tmp.log2`" 
grep 'Operation not permitted' /tmp/tmp.log2
EchoResult "不能查看其他进程下面的文件"

